[RTOS Support] Malformed DNS packets crash FreeRTOS+TCP

The FreeRTOS kernel is now an MIT licensed AWS open source project, and these pages are being updated accordingly.

Quality RTOS & Embedded Software

About Contact Support FAQ Download

Menu

Quick Start

Supported MCUs

PDF Books

Trace Tools

Ecosystem

Quick Start Guide

Support Forum

⇓ Download Source ⇓

FreeRTOS+ Ecosystem

FreeRTOS+TCP:
Thread safe TCP/IP stack

SafeRTOS:
TUV certified RTOS

OpenRTOS:
Commercial Licensed RTOS

Fail Safe File System:
Ensures data integrity

FreeRTOS BSPs:
3rd party driver packages

Trace & Visualisation:
Tracealyzer for FreeRTOS

CLI:
Command line interface

WolfSSL SSL / TLS:
Networking security protocols

RTOS Training:
Delivered online or on-site

IO:
read(), write(), ioctl() interface

FreeRTOS+ Lab Projects

FreeRTOS+POSIX:
POSIX threading API

FreeRTOS+FAT:
Thread aware file system

FreeRTOS Support Archive

The FreeRTOS support forum is used to obtain active support directly from Real Time Engineers Ltd. In return for using our top quality software and services for free, we request you play fair and do your bit to help others too! Sign up to receive notifications of new support topics then help where you can.

This is a read only archive of threads posted to the FreeRTOS support forum. The archive is updated every week, so will not always contain the very latest posts. Use these archive pages to search previous posts. Use the Live FreeRTOS Forum link to reply to a post, or start a new support thread.

[FreeRTOS Home] [Live FreeRTOS Forum] [FAQ] [Archive Top] [October 2016 Threads]

Malformed DNS packets crash FreeRTOS+TCP

Posted by jjr-simiatec on October 7, 2016

While testing a PIC32 port for FreeRTOS+TCP, I've been using Zenmap (part of the Nmap suite) as a quick way of generating a lot of random flavoured packets quickly. After fixing my own code enough to create the illusion of stability, I discovered bad DNS packets can result in 'bad things happening'. This is because the counted byte fields are not checked to see if they go out of bounds while parsing which results in a GPF in extreme cases.

I have patched FreeRTOS_DNS.c to keep track of buffer remaining while parsing progresses. This has at least kept the microcontroller alive against a battery of tests for the last few days.

Are the code modifications useful to anyone, or is this bug report sufficient?

Thanks.

Malformed DNS packets crash FreeRTOS+TCP

Posted by rtel on October 7, 2016

Hi John, thanks for taking the time to report this. I would be grateful if you could attached the patched file to a post so we can investigate further.